Structure-Preserving Pairing-Based Cryptography

基于配对的密码学在过去十年中蓬勃发展，因为它为传统密码学方法不足以或效率较低的问题提供了安全的解决方案。Boneh和Franklin在一篇开创性的论文中展示了如何使用基于配对的技术来构建基于身份的加密。这使得在某人的身份(例如他们的电子邮件地址)下加密消息成为可能，从而消除了为每个用户获取或管理公钥的需要。在大型组织中，这简化了密钥管理，基于身份的密钥管理解决方案现在被多家财富500强公司使用。另一个例子出现在相互通信的普适计算系统(如智能汽车)的背景下。在一辆智能汽车中，每隔300ms处理来自周围车辆的数百条消息，将通信降至最低并优化效率是至关重要的。基于配对的数字签名在这种情况下可能很有用，因为它们比传统的数字签名更小，同时允许一次快速验证大量签名。基于配对的密码学的其他拟议应用包括电子现金、可搜索的加密数据、广播加密和叛徒追踪、可委托的匿名凭证以及验证存储在云计算设施中的数据的存在。在所有这些任务中，安全都是必不可少的。随着我们的社会日益数字化和网络化，罪犯、黑客、工业间谍、敌对国家等也越来越多。因此，有必要设计安全的密码方案，用于建立一个在恶意对手面前具有弹性的数字社会。为复杂任务设计密码协议需要大量的努力和专业知识，因为即使是一个小错误也可能使整个系统变得不安全。因此，以模块化方式构建加密协议是很自然的。这就是基于结构保持配对的密码术所允许的。术语结构保留指的是基于配对的方案，这些方案保留了其基本的数学结构。我们将设计基于结构保持的配对密码方案，研究基于结构保持的配对密码方案的效率极限，评估基于配对的密码方案的安全性，通过设计基于结构的基于配对的密码方案，为数字社会开发新的构件。此外，我们开发的用于设计结构保持方案的技术可以为比目前可能的更复杂的任务建立基于配对的方案。最近的工作表明，保持结构的数字签名的效率是有限的。通常很难找到效率限制，研究人员往往会在不知道原因的情况下在某个点陷入困境，但由于其独特的性质，结构保持协议使他们能够进行准确的效率分析。通过寻找基于结构保持的配对方案的效率极限，我们可以准确地了解各种密码任务的确切效率。密码方案的安全性依赖于难度假设；例如，在短时间内因式分解大整数在计算上是不可行的。不幸的是，基于配对的加密方案一直基于大量不同的假设，因此很难评估它们的安全性。我们将绘制出在基于配对的密码学中使用的假设的图景，并使其更容易评估基于配对的密码方案的安全性。

Pairing-based cryptography has boomed over the last decade since it provides secure solutions to problems where traditional cryptographic methods do not suffice or are less efficient. Boneh and Franklin in a seminal paper showed how to construct identity-based encryption using pairing-based techniques. This makes it possible to encrypt a message under somebody's identity, for instance their e-mail address, eliminating the need to obtain or manage a public key for each user. In large organizations this simplifies key management and identity-based key-management solutions are now used in several Fortune 500 companies. Another example arises in the context of pervasive computing systems such as intelligent cars that communicate with each other. In an intelligent car processing hundreds of messages from surrounding vehicles in every 300ms interval it is essential to minimize communication and optimise efficiency. Pairing-based digital signatures can be useful in this scenario because they are smaller than traditional digital signatures and at the same time allow for fast verification of a large batch of signatures at once. Other proposed applications of pairing-based cryptography include e-cash, searchable encrypted data, broadcast encryption and traitor tracing, delegatable anonymous credentials, and verifying the presence of data stored in a cloud computing facility. Security is essential in all of these tasks. As our society has become increasingly digitized and networked so have criminals, hackers, industrial spies, enemy states, etc. It is therefore necessary to design secure cryptographic schemes that can be used to build a digital society that is resilient in the presence of malicious adversaries.Designing cryptographic protocols for complex tasks requires significant effort and expertise since even a small mistake may render the entire system insecure. It is therefore natural to build cryptographic protocols in a modular fashion. This is what structure-preserving pairing-based cryptography allows. The term structure-preservation refers to pairing-based schemes that preserve their underlying mathematical structure. This structure-preserving property makes it easy to compose them with other pairing-based schemes and enables modular design.We will design structure-preserving pairing-based cryptographic schemes, study the efficiency limits of structure-preserving pairing-based cryptographic schemes and evaluate the security of pairing-based cryptographic schemes.By designing structure-preserving pairing-based schemes we develop new building blocks for the digital society. Moreover, the techniques we develop for the design of structure-preserving schemes may make it possible to build pairing-based schemes for significantly more complex tasks than is currently possible.Very recent work has shown that there are limits to how efficient structure-preserving digital signatures can be. It is usually very difficult to find efficiency limitations, researchers just tend to get stuck at some point without knowing why, but because of their unique nature structure-preserving protocols lend themselves to exact efficiency analysis. By finding efficiency limits for structure-preserving pairing-based schemes, we can get an accurate picture of the exact efficiency for a variety of cryptographic tasks.Security is essential when designing cryptographic protocols. The security of cryptographic schemes relies on hardness assumptions; for instance that it is computationally infeasible to factor large integers in a short amount of time. Unfortunately, pairing-based cryptographic schemes have been based on a large variety of assumptions making it hard to assess how secure they are. We will map out the landscape of assumptions that are used in pairing-based cryptography and make it easier to assess the security of pairing-based cryptographic schemes.